44caliber | d6ff445d907d3cf0ca59cc2fa738de8b83f03c8bcb1420f425adf5b113fbdf38

General

Target

Loader.exe
Size

303KB
MD5

06cefa8ca9d8b957ff7862c2bc095532
SHA1

00ddd5275d33b114891e8a1304f022cf31a3badc
SHA256

d6ff445d907d3cf0ca59cc2fa738de8b83f03c8bcb1420f425adf5b113fbdf38
SHA512

5e53b85ac8694cdcfab457a872811a5e42da18ab41de32b12d2ed28c32b9e4090c069833caf6fc9b02f9717314f5647027f85b506bea6ecf6f639d64c8d4aa90
SSDEEP

6144:uNFT6MDdbICydeBpxUKCa269TwHfw6fmA1D0H/s:uNzIKCa2yT301DUs

Score

10^/10

44caliber discovery spyware stealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1338494455816130602/RfPMucy7qNgnF1KO1MI5iOATLOqPdaYE1pn3HhuPCtXjqRXs3t1NFhCJsYBUYOc2mSD5

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
44Caliber family
44caliber

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	3916	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	freegeoip.app
2	freegeoip.app

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2040	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3672	Loader.exe
3672	Loader.exe
3672	Loader.exe
3672	Loader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	Loader.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjE5MDQ4NUEtN0RGMC00QTMxLTlFRkItRDBGMjdGOTdDNUUyfSIgdXNlcmlkPSJ7QjM4NDI1RTQtRUExRS00MjcwLUI1MjktNDAwM0MxQjNDRTIzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MTU5MzM0RjQtOTBEMS00NDcxLUFEQ0QtMjZBRkFBMzBCN0E3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU1NzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODAxNjUyMzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODg1NTgzNTIyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
740B

MD5
71ab401e1f7dc7d4adb883d32f9604a4

SHA1
0b4c52575c79067830dc3cdd011cbaf85a6c2246

SHA256
c9218050a64dfc5ffcd838b8ac81215c7f1ea8b2e38ac69dfaeb586a50494866

SHA512
7bd7c884b01ecf127615cdbde4037b264944b5101431da1d3cc7d3b1e97a69aca6d562d5f90c2af2e9434acf75e68461c4fb734e6c191b8acafc96794fe4689b

Download Submit
C:\Users\Admin\AppData\Local\44\Process.txt

Filesize
1KB

MD5
e977f2b433a90fe756d9f57d366e2577

SHA1
6d1313aad6677251efaa09665c26fb9e7a49a5e9

SHA256
1483a14f3d657cda5eab9e635a677a74d2c90877f1475c1e5c37393a6e3b74ed

SHA512
039f6a5f7730d93ccb61543b75c770cdc7dce6078f092c35dcca3d0b03c9cfd48a04891a3a07b27af6bce6430b213070a21c8dfb652d14f43f53a22461b83cd6

Download Submit
memory/3672-1-0x00000203EEA10000-0x00000203EEA62000-memory.dmp

Filesize
328KB

Download
memory/3672-0-0x00007FFD734F3000-0x00007FFD734F5000-memory.dmp

Filesize
8KB

Download
memory/3672-16-0x00007FFD734F0000-0x00007FFD73FB1000-memory.dmp

Filesize
10.8MB

Download
memory/3672-118-0x00007FFD734F0000-0x00007FFD73FB1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing